The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It reads session metadata, task descriptions, and role specifications from a user-provided directory (team-session.json, task-analysis.json, and role-specs/*.md) and injects these values directly into the prompts for newly spawned team-worker agents.
Ingestion points: The --session argument defines the source directory for team-session.json and role-specs/ markdown files.
Boundary markers: Absent. Instructions and data are interpolated directly into template strings (e.g., requirement: <task-description>) without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill can spawn background agents (Agent tool) and execute shell commands (Bash tool).
Sanitization: The skill performs structural validation (checking for JSON fields and file existence) but does not sanitize the content of strings processed into agent prompts.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform state reconciliation and file management tasks. While these operations are defined for orchestration, the tool itself provides an unconstrained execution environment that could be abused if the agent is influenced by malicious session data.

team-executor